Security
An overview of the current security measures, architecture, and the way Loalyx protects documents, approvals, and workspace access. This page describes the current state of the service and is not a standalone contractual warranty.
Architecture and data storage
Loalyx runs as a production SaaS on Next.js, Prisma and Neon Postgres. Documents are stored in Cloudflare R2 and the application is hosted on Vercel. PDF files are not written to persistent local disk; they are uploaded to object storage after generation.
- application runtime and hosting: Vercel
- primary database: Neon Postgres
- document storage: Cloudflare R2
- transactional email: Resend
Authentication and access control
Access to the application is protected with account sessions and passwords are stored only as hashes. Data access is enforced per workspace and per project using OWNER, EDITOR, VIEWER and APPROVER roles.
- server-side workspace and project access checks
- invite onboarding bound to a specific email address
- the public approval link is read-only; approval itself is separately protected with OTP
- sensitive endpoints are protected with rate limiting
Documents and approval flow
Generated PDFs are delivered through time-limited signed URLs. The approval flow keeps an audit trail for each version and stores the approver, approval timestamp, and hashed technical metadata when an approval is recorded.
- document versioning for every project version
- audit trail for important actions including generation and approval
- OTP is used for approval, not for document viewing
- approval tokens are stored only as hashes
What we intentionally do not store
Loalyx is not a secret vault. If a project requires test accounts, the recommended process is to share them out-of-band. The product is designed for scope, workflow and auditability, not for credential management.
- we do not store user passwords in plaintext
- we do not treat test passwords as standard form content
- IP and user-agent metadata used in approval / waitlist flows are stored in hashed form when recorded
Operational safeguards
- rate limiting on login, invites, OTP and approval-related endpoints
- security headers for the web application
- SSRF protection for branding logo URLs
- job-based PDF generation separated from the main request path
- server-side validation before version creation and before approval
Reporting a security issue
If you find a vulnerability or security issue, please contact hello@loalyx.app. Include a description of the issue, reproduction steps, and the potential impact. Please use responsible disclosure and only test systems for which you have authorization.